Why are GET requests returning JSON disallowed by default?

The reason for the DenyGet default is on MSDN with a link to Phil Haack’s blog for further details. Looks like a Cross-Site scripting vulnerability.